How can I tell if a user belongs to an role in active directory - using ColdFusion

Question

If I am using integration authentication in IIS, how can I determine if the current user is part of a specific active directory role, using ColdFusion.

This would be analogous to using the IsInRole() method of the User object in .net - how can it be done in ColdFusion

Answer 1

In coldfusion to check a users role you would use IsUserInRole()

http://cfquickdocs.com/#IsUserInRole

Edit - And actually I hope I understood correctly, I don't know anything about IIS or active directory. As I understood the question you wanted to check a users role in Coldfusion.

I think you may be looking for something more like this: http://vincentcollins.com/2008/08/20/active-directory-ldap-authentication/ or this: http://coldfusion.sys-con.com/node/154225

Answer 2

the only way to do this is to use cflap and query the active directory server to get a list of groups. after you've gotten the list, you will need to parse it to see if that user belongs to the group in question. below is some code i wrote with some comments for the people at work. values have been changed to protect the innocent.

<!--- getting the user login id --->
<cfset variables.thisuser = ListLast(cgi.AUTH_USER, "\")>
<!--- this is the group they must be a memberof --->
<cfset variables.groupname = "CN=<the group to search for>">
<!--- list of all groups that the user belongs to, will be populated later --->
<cfset variables.grouplist = "">

<cftry>
    <cfldap action="query"
     name="myldap"
     attributes="memberOf"
     start="OU=<your ou>,DC=<your dc>,DC=<your dc>"
     scope="subtree"
     filter="(sAMAccountName=#variables.thisuser#)"
     server="<your AD server ip>"
     port="<your AD server port>"
     username="<network login if required>"
     password="<network password if required>">

    <cfset variables.grouplist = myldap.memberOf>

<cfcatch>
    </cfcatch>
</cftry>

<cfif FindNoCase(variables.groupname, variables.grouplist)>

    <cfcookie name="SecurityCookieName" value="">

</cfif>

Answer 3

Just as a follow up, SQL server has ADSI providers that allow you to create a linked server to your LDAP servers.

From there you can do ldap queries to your AD and it returns like any other record set.

I find it a little easier to do complex ldap query then via CF.

Byron Mann [email protected] [email protected] Software Architect hosting.com | hostmysite.com http://www.hostmysite.com/?utm_source=bb